CVE-2019-14892
CRITICALFasterxml Jackson-databind < 2.6.7.3 - Information Disclosure
Title source: ruleDescription
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Exploits (2)
nomisec
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2019-14892-jackson-databind-vulnerable
nomisec
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2019-14892-jackson-databind-vulnerable
References (6)
Scores
CVSS v3
9.8
EPSS
0.0087
EPSS Percentile
75.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
CWE-200
Status
published
Affected Products (10)
fasterxml/jackson-databind
< 2.6.7.3
redhat/decision_manager
redhat/jboss_data_grid
redhat/jboss_data_grid
redhat/jboss_enterprise_application_platform
redhat/jboss_fuse
redhat/openshift_container_platform
redhat/process_automation
apache/geode
com.fasterxml.jackson.core/jackson-databind
< 2.6.7.3Maven
Timeline
Published
Mar 02, 2020
Tracked Since
Feb 18, 2026